The inner "toad" says that this is a waste. But perhaps for a start, we will abandon the Kraken. I also wanted to ask, the guys from Kraken are categorically against external HTTP authorization, they motivate this with the high cost and possible errors. Your approach goes in the opposite direction. Where is the truth?